{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-38632",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-38632",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-08-22T16:00:40.423Z",
    "updatedAt": "2026-05-23T16:00:13.275Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "pinmux: fix race causing mux_owner NULL with active mux_usecount",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\npinmux: fix race causing mux_owner NULL with active mux_usecount\n\ncommit 5a3e85c3c397 (\"pinmux: Use sequential access to access\ndesc->pinmux data\") tried to address the issue when two client of the\nsame gpio calls pinctrl_select_state() for the same functionality, was\nresulting in NULL pointer issue while accessing desc->mux_owner.\nHowever, issue was not completely fixed due to the way it was handled\nand it can still result in the same NULL pointer.\n\nThe issue occurs due to the following interleaving:\n\n     cpu0 (process A)                   cpu1 (process B)\n\n      pin_request() {                   pin_free() {\n\n                                         mutex_lock()\n                                         desc->mux_usecount--; //becomes 0\n                                         ..\n                                         mutex_unlock()\n\n  mutex_lock(desc->mux)\n  desc->mux_usecount++; // becomes 1\n  desc->mux_owner = owner;\n  mutex_unlock(desc->mux)\n\n                                         mutex_lock(desc->mux)\n                                         desc->mux_owner = NULL;\n                                         mutex_unlock(desc->mux)\n\nThis sequence leads to a state where the pin appears to be in use\n(`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can\ncause NULL pointer on next pin_request on the same pin.\n\nEnsure that updates to mux_usecount and mux_owner are performed\natomically under the same lock. Only clear mux_owner when mux_usecount\nreaches zero and no new owner has been assigned.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9b2a3e7189028aa7c4d53a84364f2ea9fb209787"
            },
            {
              "version": "c11e2ec9a780f54982a187ee10ffd1b810715c85",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9ea3f6b9a67be3476e331ce51cac316c2614a564"
            },
            {
              "version": "5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804"
            },
            {
              "version": "5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e",
              "status": "affected",
              "versionType": "git",
              "lessThan": "22b585cbd67d14df3b91529d1b990661c300faa9"
            },
            {
              "version": "5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e",
              "status": "affected",
              "versionType": "git",
              "lessThan": "0b075c011032f88d1cfde3b45d6dcf08b44140eb"
            },
            {
              "version": "6.6.66",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.6.102"
            },
            {
              "version": "6.12.5",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.12.42"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.13",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.13"
            },
            {
              "version": "6.6.102",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.42",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.15.10",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.15.*"
            },
            {
              "version": "6.16.1",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.16.*"
            },
            {
              "version": "6.17",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}